Xen CVE-2026-62431 Viridian STIMER Div-by-Zero DoS Patch Advisory

Vulnerability Overview Vulnerability Name: Viridian STIMER division by zero CVE ID: CVE-2026-62431 Publication Date: 2026-07-28 12:00 Update Version: 2026-07-28 12:05 Version: 2 Impact Scope Affected Systems: All Xen versions from 4.13 onwards. Xen 4.12 and earlier versions are not affected. Trigger Conditions: This vulnerability can only be triggered by HVM virtual machines with Viridian STIMER enabled. Impact: Enabling Viridian STIMER on unprivileged HVM virtual machines may cause a denial of service (DoS) for the entire host. Remediation Patch: Applying the attached patch resolves this issue. Patch Files: - (signed advisory file) - Patch Hash: Deployment During Embargo: During the embargo period, deployment of the above-mentioned patch (or a similar patch) is permitted, even on public hosting platforms and even for untrusted virtual machine users and administrators. Distribution Restrictions: Distribution of updated software is prohibited during the embargo period (except for other members on the pre-disclosure list). Pre-disclosure List Members: Members of the pre-disclosure list who wish to deploy significantly different patches and/or mitigations should contact the Xen Project Security Team. Note: This embargo period deployment notification no longer applies under the Xen Project Security Policy published publicly after the embargo period. This is to allow the Xen Project Security Team to oversee decision-making. More Information: For more information regarding the permitted use of encrypted information, please refer to the security policy agreed upon by the Xen Project community: http://www.xenproject.org/security-policy.html

Goal Reached Thanks to every supporter — we hit 100%!

Xen CVE-2026-62431 Viridian STIMER Div-by-Zero DoS Patch Advisory